NoxManga: Fix 401 by signing API requests - #18482
Merged
Merged
Conversation
The source moved to noxmangas.org and its API now rejects unsigned requests. Adds an interceptor that derives the slot, token and secret from the site signer script and signs every API call, refreshing it on 401. Also migrates the source to KeiSource.
| ?.let { append(" - ", it) } | ||
| } | ||
| chapter_number = number | ||
| date_upload = publishedAt?.let(Instant::parseOrNull)?.toEpochMilliseconds() ?: 0L |
| } | ||
| chapter_number = number | ||
| date_upload = publishedAt?.let(Instant::parseOrNull)?.toEpochMilliseconds() ?: 0L | ||
| memo = buildJsonObject { put("id", id) } |
Contributor
There was a problem hiding this comment.
if id is unique, perhaps set id in url and rest of needed data in memo
| import java.io.IOException | ||
| import java.security.MessageDigest | ||
|
|
||
| class SignatureInterceptor(private val baseUrl: String) : Interceptor { |
Contributor
There was a problem hiding this comment.
make this a lambda so baseurl is always captured from source.baseUrl
Use Instant.tryParse, store the chapter id in the url with the rest in memo, and take the base url as a lambda in the interceptor.
AwkwardPeak7
approved these changes
Aug 19, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #17907
The source moved from
noxtoons.comtonoxmangas.organd its API moved fromxodneo.siteto/api/v1on the site's own domain. That API now rejects unsigned requests with401 {"error":"Assinatura de requisição obrigatória"}, which is what users are hitting.The site loads
/_nix/signer.js, which carries the current slot, a rotating token and the secret used to sign each path.SignatureInterceptorparses that script and signs every API call withbase64url(SHA-256("METHOD|path|siteId|slot|token|key")), sendingX-Site-ID,X-Web-Slot,X-Web-TokenandX-Web-Signature, and re-fetching the signer on a 401.Two details worth knowing for future maintenance:
Sec-Fetch-Siteis required. Without it the server falls back to a different scheme and asks forX-Signature+X-Timestampinstead.Other changes:
KeiSource./api/. It previously applied to every request, and since the chapter images are served from the same host (/ii/...), a 120 page chapter had a ~40s floor of artificial waiting./api/v1/genres.contentWarningset toMIXED(the site has an adult section alongside regular content)./ler/key so existing reading history is preserved, whilegetChapterUrlpoints to the site's new/read/reader.Tested on an emulator with Mihon: popular, latest, text search, URL search, filters, details, chapter list and reading pages.
Checklist:
versionCodevalue inbuild.gradle.ktsbaseVersionCodeinbuild.gradle.kts(if updated multisrc theme code)contentWarningconfiguration inbuild.gradle.ktsappropriatelyidif a source's name or language were changedweb_hi_res_512.pngwhen adding a new extension